{"id":"CVE-2026-115749","kind":"vulnerability","aliases":["CVE-2026-115749"],"related":[],"title":"hydra-ray-launcher: config resolver lets attackers import any installed module","description":"hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.","summary":"hydra-ray-launcher passes a configuration value straight into importlib.import_module() through its ray_pkg_version OmegaConf resolver. An attacker who controls config values or command-line overrides can import any installed module and trigger its import-time side effects inside the application process.","severity":"medium","cvss":4.8,"epss":0.00323,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hydra","ml-pipelines","package","python","ray"],"not_affected_if":["fixed-config","no-untrusted-overrides","patched-version"],"how_to_check":"- Run `pip show hydra-ray-launcher` to see the installed version.\n- Search configs and launch scripts for `ray_pkg_version` interpolations, for example `${ray_pkg_version:...}`.\n- Check whether untrusted input reaches Hydra overrides, such as request parameters or CLI arguments built from user data.","fix":"- Upgrade hydra-ray-launcher to `1.2.2` on the 1.x line, or to `1.4.0rc2` on the 1.4 development line.\n- Stop passing untrusted values into Hydra configs and command-line overrides until the upgrade is done.","status":"open","published_at":"2026-10-23T13:17:09+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:33:01+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hydra-ray-launcher to `1.2.2` on the 1.x line, or to `1.4.0rc2` on the 1.4 development line.\n- Stop passing untrusted values into Hydra configs and command-line overrides until the upgrade is done.","reach":"unknown","title":"hydra-ray-launcher: config resolver lets attackers import any installed module","impact":"high","summary":"hydra-ray-launcher passes a configuration value straight into importlib.import_module() through its ray_pkg_version OmegaConf resolver. An attacker who controls config values or command-line overrides can import any installed module and trigger its import-time side effects inside the application process.","category":"package","nicknames":[],"who_cares":["python","hydra","ray","ml-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Any installed module gets imported, running its import-time code in the app","analyst_note":"Confirm from the NVD entry or the upstream advisory whether untrusted network input, not just config files, can reach the resolver, and whether the fixed versions are the ones listed.","how_to_check":"- Run `pip show hydra-ray-launcher` to see the installed version.\n- Search configs and launch scripts for `ray_pkg_version` interpolations, for example `${ray_pkg_version:...}`.\n- Check whether untrusted input reaches Hydra overrides, such as request parameters or CLI arguments built from user data.","needs_analyst":true,"not_affected_if":["fixed-config","no-untrusted-overrides","patched-version"],"who_is_affected":"Teams using hydra-ray-launcher versions `1.1.0.dev1` up to `1.2.2` or `1.4.0.dev4` up to `1.4.0rc2` are exposed. Exposure requires that config values or command-line overrides come from someone who should not control them, so teams that only use fixed, locally written configs have much lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000691,"input_tokens":3398,"output_tokens":702,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115749':15A,18A '-2026':14A,17A '1.1.0':77C '1.2.2':80C '1.4.0':82C,85C 'applic':71B,135C 'arbitrari':89C 'attack':8A,46B,105C 'command':53B,111C 'command-lin':52B,110C 'config':5A,49B 'configur':32B,107C 'contain':87C 'control':48B,106C 'cve':13A,16A 'dev1':78C 'dev4':83C 'effect':68B,132C 'hydra':2A,19B,27B,74C 'hydra-ray-launch':1A,26B,73C 'import':9A,57B,65B,91C,122C,129C 'import-tim':64B,128C 'importlib.import':36B,103C 'input':101C 'insid':69B 'instal':11A,59B,124C 'interpol':120C 'launcher':4A,29B,76C 'let':7A 'line':54B,112C 'ml':21B 'ml-pipelin':20B 'modul':12A,37B,60B,90C,104C,125C 'omegaconf':43B,98C 'overrid':55B,113C 'packag':23B 'pass':30B,100C 'pipelin':22B 'pkg':41B,96C,118C 'process':72B,136C 'python':24B 'ray':3A,25B,28B,40B,75C,95C,117C 'rc2':86C 'resolv':6A,44B,99C 'side':67B,131C 'straight':34B 'suppli':115C 'time':66B,130C 'trigger':62B,126C 'valu':33B,50B,108C 'version':42B,97C,119C 'via':93C 'vulner':92C","nicknames":[],"mitigations":[],"who_affected":"Teams using hydra-ray-launcher versions `1.1.0.dev1` up to `1.2.2` or `1.4.0.dev4` up to `1.4.0rc2` are exposed. Exposure requires that config values or command-line overrides come from someone who should not control them, so teams that only use fixed, locally written configs have much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115749","severity":null,"published_at":"2026-10-23T13:17:09+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115749","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115749","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}